vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix: hand the review classifier its store leaf as an nspawn credential

Browse source 
The leaf's key was copied by a host unit into the container's root on
host disk. nspawn now reads the cert, key and store CA as root at
container start (--load-credential) and passes them in as system
credentials; the daemon's unit loads them by bare id, as an agent's
container does with its own leaf (nix/agent-modules/bao.nix). The copy
unit is gone. Where this host mints the leaf, the container starts after
swarm-bao-pki, since nspawn refuses a missing credential source. An
assertion refuses identity paths with whitespace, which nixos-container's
unquoted extra flags would split.
This commit is contained in:
atlas 2026-10-12 04:09:03 +02:00 • committed by mara
commit 8e33de6fb7
3 changed files with 57 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

3
swarm-review-classifier/README.md
View file

@ -26,7 +26,8 @@ forge and holds no forge credential.
## Credentials
The container holds one file: its own store certificate. With it the service
The container holds one credential: its own store certificate, which nspawn
hands in at start without a copy on disk. With it the service
reads its queue client secret at start and the API key at every run, so a key
written or removed in the store takes effect on the next run. Its store role
reads exactly those two paths.